Belkin Fixes WeMo Vulnerabilities With Firmware Update

February 19, 2014 at 16:08 PM EST

Fear not, owners of Belkin WeMo devices: you no longer have to lose sleep over the possibility that your smart plug will be hacked. Belkin has rolled out an update that patches the five vulnerabilities listed by FEMA’s Computer Emergency Readiness Team. This security hole affects up to 500,000 WeMo devices, and as CERT states, the vulnerability could result in anything from a fire to the waste of electricity. These holes were recently discovered and announced by IOActive, Inc. As the press release states, the security company made several attempts to contact Belkin about the issues, but Belkin was unresponsive. So IOActive turned to CERT who also issued a statement. However, per a statement Belkin sent to TechCrunch (embedded below), Belkin was in fact in contact with the security research firm prior to their public statement. Specifically, Mike Davis, IOActive’s principal research scientist, identified that through several different means, hackers could remotely access Internet-connected WeMo products, upload custom firmware, remotely monitor devices and access local networks. The update Belkin recently issued patches these holes. This speaks to a larger issue. As the Internet of things takes off, hackers and malicious coders have an increasing number of targets. It’s not inconsivable that in the near future, KitchenAid will have to issue a security patch for a toaster or blender. Belkin’s Statement Belkin has corrected the list of five potential vulnerabilities affecting the WeMo line of home automation solutions that was published in a CERT advisory on February 18. Belkin was in contact with the security researchers prior to the publication of the advisory, and, as of February 18, had already issued fixes for each of the noted potential vulnerabilities via in-app notifications and updates. Users with the most recent firmware release (version 3949) are not at risk for malicious firmware attacks or remote control or monitoring of WeMo devices from unauthorized devices. Belkin urges such users to download the latest app from the App Store (version 1.4.1) or Google Play Store (version 1.2.1) and then upgrade the firmware version through the app. Specific fixes Belkin has issued include: 1) An update to the WeMo API server on November 5, 2013 that prevents an XML injection attack from gaining access to other WeMo devices. 2) An update to the WeMo firmware, published on January 24, 2014, that adds SSL encryption and validation to the WeMo firmware distribution feed, eliminates storage of the

These holes were recently discovered and announced by IOActive, Inc. As the press release states, the security company made several attempts to contact Belkin about the issues, but Belkin was unresponsive. So IOActive turned to CERT who also issued a statement. However, per a statement Belkin sent to TechCrunch (embedded below), Belkin was in fact in contact with the security research firm prior to their public statement.

Specifically, Mike Davis, IOActive’s principal research scientist, identified that through several different means, hackers could remotely access Internet-connected WeMo products, upload custom firmware, remotely monitor devices and access local networks.

The update Belkin recently issued patches these holes.

This speaks to a larger issue. As the Internet of things takes off, hackers and malicious coders have an increasing number of targets. It’s not inconsivable that in the near future, KitchenAid will have to issue a security patch for a toaster or blender.

Belkin’s Statement

Belkin has corrected the list of five potential vulnerabilities affecting the WeMo line of home automation solutions that was published in a CERT advisory on February 18. Belkin was in contact with the security researchers prior to the publication of the advisory, and, as of February 18, had already issued fixes for each of the noted potential vulnerabilities via in-app notifications and updates. Users with the most recent firmware release (version 3949) are not at risk for malicious firmware attacks or remote control or monitoring of WeMo devices from unauthorized devices. Belkin urges such users to download the latest app from the App Store (version 1.4.1) or Google Play Store (version 1.2.1) and then upgrade the firmware version through the app.

Specific fixes Belkin has issued include:

1) An update to the WeMo API server on November 5, 2013 that prevents an XML injection attack from gaining access to other WeMo devices.

2) An update to the WeMo firmware, published on January 24, 2014, that adds SSL encryption and validation to the WeMo firmware distribution feed, eliminates storage of the signing key on the device, and password protects the serial port interface to prevent a malicious firmware attack

3) An update to the WeMo app for both iOS (published on January 24, 2014) and Android (published on February 10, 2014) that contains the most recent firmware update